Kimsuky

{
  "id": "ATTACK:enterprise:G0094",
  "title": "Kimsuky",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0094",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--0ec2f388-bf0f-4b5c-97b1-fc736d26c25f",
  "external_id": "G0094",
  "domain": "enterprise",
  "created": "2019-08-26T15:03:02.577Z",
  "modified": "2026-07-31T20:48:24.117Z",
  "version": "5.2",
  "aliases": [
    "Kimsuky",
    "Black Banshee",
    "Velvet Chollima",
    "Emerald Sleet",
    "THALLIUM",
    "APT43",
    "TA427",
    "Springtail",
    "Earth Kumiho",
    "PatheticSlug"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
      "url": "https://blog.cloudflare.com/2026-threat-report/"
    },
    {
      "source_name": "PatheticSlug"
    },
    {
      "source_name": "Black Banshee"
    },
    {
      "source_name": "THALLIUM"
    },
    {
      "source_name": "APT43"
    },
    {
      "source_name": "Emerald Sleet"
    },
    {
      "source_name": "TA427"
    },
    {
      "source_name": "Earth Kumiho"
    },
    {
      "source_name": "Kimsuky"
    },
    {
      "source_name": "Springtail"
    },
    {
      "source_name": "Velvet Chollima"
    },
    {
      "source_name": "AhnLab Kimsuky Kabar Cobra Feb 2019",
      "url": "https://global.ahnlab.com/global/upload/download/techreport/%5BAnalysis_Report%5DOperation%20Kabar%20Cobra.pdf"
    },
    {
      "source_name": "EST Kimsuky April 2019",
      "url": "https://blog.alyac.co.kr/2234"
    },
    {
      "source_name": "Netscout Stolen Pencil Dec 2018",
      "url": "https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"
    },
    {
      "source_name": "Zdnet Kimsuky Dec 2018",
      "url": "https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/"
    },
    {
      "source_name": "CISA AA20-301A Kimsuky",
      "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-301a"
    },
    {
      "source_name": "Cybereason Kimsuky November 2020",
      "url": "https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"
    },
    {
      "source_name": "EST Kimsuky SmokeScreen April 2019",
      "url": "https://blog.alyac.co.kr/attachment/cfile5.uf@99A0CD415CB67E210DCEB3.pdf"
    },
    {
      "source_name": "Malwarebytes Kimsuky June 2021",
      "url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
    },
    {
      "source_name": "Proofpoint TA427 April 2024",
      "url": "https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering"
    },
    {
      "source_name": "Mandiant APT43 March 2024",
      "url": "https://services.google.com/fh/files/misc/apt43-report-en.pdf"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "MSFT-AI",
      "url": "https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"
    },
    {
      "source_name": "Rapid7 Threat Landscape Actors March 2026",
      "url": "https://www.rapid7.com/cdn/assets/bltc1ddd6561ab54a26/69ba67de50ca691edcd3f5b7/rapid7-threat-landscape-report-2026.pdf"
    },
    {
      "source_name": "Symantec Troll Stealer 2024",
      "url": "https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"
    },
    {
      "source_name": "Securelist Kimsuky Sept 2013",
      "url": "https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"
    },
    {
      "source_name": "ThreatConnect Kimsuky September 2020",
      "url": "https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"
    }
  ]
}